HackTheBox - Search

Name: HackTheBox - Search
Uploaded: 2022-04-30T15:00:31Z
Channel: IppSec
Description: 00:00 - Intro 00:53 - Start of nmap 05:45 - Using Kerbrute to identify valid users 09:40 - Finding credentials for Hope.Sharp in an image on the websit...

IppSec · Beginner ·📊 Data Analytics & Business Intelligence ·3y ago

00:00 - Intro 00:53 - Start of nmap 05:45 - Using Kerbrute to identify valid users 09:40 - Finding credentials for Hope.Sharp in an image on the website 10:40 - Showing Kerbrute paswordspray silently fails when time is out of sync 13:00 - Having troubles running the Python Bloodhound Ingestor, a digestmod error 15:50 - Giving up fixing my environment, creating a python virtual environment to run this script 18:00 - Uploading data to bloodhound, discovering a kerberoastable (web_svc) account, running GetUserSPN and Cracking the hash 23:20 - Parsing the raw Bloodhound Data with JQ and dumping a…

Watch on YouTube ↗ (saves to browser)

Chapters (20)

Intro

0:53 Start of nmap

5:45 Using Kerbrute to identify valid users

9:40 Finding credentials for Hope.Sharp in an image on the website

10:40 Showing Kerbrute paswordspray silently fails when time is out of sync

13:00 Having troubles running the Python Bloodhound Ingestor, a digestmod error

15:50 Giving up fixing my environment, creating a python virtual environment to run

18:00 Uploading data to bloodhound, discovering a kerberoastable (web_svc) account,

23:20 Parsing the raw Bloodhound Data with JQ and dumping all the valid usernames

25:20 Using JQ select to show only the users that are enabled, its sql like syntax

28:50 Running a password spray with kerbrute to find edgar.jacobs has the same crede

33:25 Using CrackMapExec (CME) with the spider_plus module to dump all file names, t

36:00 Using SMBClient to download files, getting an excel document that has a protec

40:00 Using CME to run a large password spray guessing a single specific password fo

41:25 Back to Bloodhound, discovering our user can ReadGMSAPassword of an account th

43:00 Dumping files as Sierra.Frye with CME, discovering certificates, downloading t

49:10 Using CrackPkcs12 to crack the PFX certificate, then loading it into our brows

57:20 Gaining a powershell webconsole, flailing around a littlebit trying to read th

59:43 Using Get-ADServiceAccount on to read information about the GMSA Account and g

1:03:00 Running commands as the GMSA User with Powershell and Invoke-Command to reset

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →